<%
=begin
apps: harbor
platforms: kubernetes, tanzu-application-catalog
id: expose_service
title: Expose Harbor service
category: configuration
weight: 40
=end %>

There are four different ways to expose the Harbor service:

* Ingress: The ingress controller must be installed in the Kubernetes cluster. Notes: if the TLS is disabled, the port must be included in the command when pulling/pushing images. Refer to the [Harbor issues section](https://github.com/goharbor/harbor/issues/5291) in the official Harbor GitHub repository for more information on this.
* ClusterIP: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster.
* NodePort: Exposes the service on each Node's IP at a static port (the NodePort). You'll be able to contact the NodePort service, from outside the cluster, by requesting NodeIP:NodePort.
* LoadBalancer: Exposes the service externally using a cloud provider's load balancer.

### Configure the external URL

The external URL for Harbor core service is used to:

* populate the *docker/helm* commands showed on portal
* populate the token service URL returned to docker/notary client
* Format: *protocol://domain[:port]*. Usually:
  * if expose the service via Ingress, the domain should be the value of *service.ingress.hosts.core*
  * if expose the service via ClusterIP, the domain should be the value of *service.clusterIP.name*
  * if expose the service via NodePort, the domain should be the IP address of one Kubernetes node
  * if expose the service via LoadBalancer, set the domain as your own domain name and add a CNAME record to map the domain name to the one you got from the cloud provider

If Harbor is deployed behind the proxy, set it as the URL of proxy.
